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1.0 INTRODUCTION 

The space radiation environment can lead to extremely harsh operating conditions 
for on-board electronic box and systems. The characteristics of the radiation environment 
are highly dependent on the type of mission (date, duration and orbit). Radiation 
accelerates the aging of the electronic parts and material and can lead to a degradation of 
electrical performance; it can also create transient phenomena on parts. Such damage at 
the part level can induce damage or functional failure at electronic box, subsystem, and 
system levels. A rigorous methodology is needed to ensure that the radiation environment 
does not compromise the functionality and performance of the electronics during the 
system life. This methodology is called hardness assurance. It consists of those activities 
undertaken to ensure that the electronic piece parts placed in the space system perform to 
their design specifications after exposure to the space environment. It deals with system 
requirements, environmental definitions, part selection, part testing, shielding and 
radiation tolerant design. All these elements should play together in order to produce a 
system tolerant to the radiation environment. 

An overview of the different steps of a space system hardness assurance program 
is given in section 2. In order to define the mission radiation specifications and compare 
these requirements to radiation test data, a detailed knowledge of the space environment 
and the corresponding electronic device failure mechanisms is required. The presentation 
by J. Mazur deals with the Earth space radiation environment as well as the internal 
environment of a spacecraft. The presentation by J. Schwank deals with ionization 
effects, and the presentation by T. Weatherford deals with Single particle Event 
Phenomena (SEP) in semiconductor devices and microcircuits. These three presentations 
provide more detailed background to complement the sections 3 and 4. Part selection and 
categorization are discussed in section 5. Section 6 presents the organization of the 
hardness assurance within a project. Section 7 discusses emerging radiation hardness 
assurance issues. 


2.0 RADIATION HARDNESS ASSURANCE OVERVIEW 

Figure 1 gives an overview of the radiation hardness assurance process. A short 
description of the different steps follows with details given in the subsequent chapters. 
This process is iterative. It starts first with top-level estimations of the radiation 
environment, then the radiation levels are refined and the electronic designs analyzed in 
order to validate the most sensitive parts. 

A. Description of the mission radiation environment and definition of the radiation 
levels within the spacecraft: The particle spectra (heavy ion Linear Energy 
Transfer (LET) spectra, proton and electron spectra and dose-depth curves) for the 
specific mission are defined. This will be used for the definition of the radiation 
levels within spacecraft and/or the radiation specification levels. 

B. Assessment on parts radiation sensitivity: The radiation hardness of the parts is 
estimated on the basis of radiation databases and relevant radiation tests. 

C. Radiation aspects in Worst Case Analysis (WCAi of system and circuit design: 
Parts radiation sensitivity data is used to perform a worst-case analysis of the 
circuit design. The overall equipment and spacecraft worst case performance over 
the mission length, taking into account radiation effects, aging and other causes of 
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degradation is estimated. By combining the system application of each part and its 
radiation response, a radiation failure level can be determined for each part. 

D. Part categorization: The radiation failure of each part is compared to its mission 
radiation level or the radiation requirements and a decision is made concerning 
the hardness of those devices in the system. The part categorization is the key 
activity of a hardness assurance program. The factor used to select which category 
the part falls into for each radiation environment is the Radiation Design Margin 
(RDM). RDM is defined as the ratio of the part failure level to the part radiation 
environment. When the part hardness greatly exceeds the system requirements, 
the part is not hardness critical and can be used in this application without any 
further action. 

• When the part hardness is lower than the radiation level (RDM<1), the part 
can not be used as is and risk reduction tasks should be performed. 

- Investigation: A more accurate estimation of the radiation level (e.g. 
using a 3 D Monte-Carlo code to calculate the total dose level received by 
the part) may allow a reduction of the radiation requirement. On the other 
hand, a complementary radiation test closer to the application conditions 
may also increase the radiation failure level of the part. 

- System or equipment level countermeasure: Countermeasures can be 
implemented to either increase the acceptable sensitivity level of the part 
or reduce the radiation environment: additional shielding at component 
level (spot shielding) or at box level (additional thickness of box cover), 
switching of redundant component or function, error correction system, 
specific memory organization, latch-up protection circuitry, etc. 

- Part replacement: The part is replaced by another part having a higher 
radiation tolerance. 

• When the part hardness is not significantly higher than the system 
requirements, the part is considered radiation hardness critical. In order to 
minimize the risk associated with the spread of device hardness between 
manufacturing lots (and also within the same manufacturing lot), flight lot 
parts can be tested during procurement. 

During the lifetime of a mission’s design and development, multiple variables change. 

These include: 

updates to parts list 
revised spacecraft layout 

- revised mission requirements such as mission duration 

- addition of new payloads, or 

the discovery of new radiation effects information. 

Due to these and other factors, many of the steps in the approach may be revisited 

throughout the mission’s radiation hardness assurance program. 
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Figure 1 : Overview of the radiation hardness assurance process. 


3*0 DEFINE THE SPACE RADIATION ENVIRONMENT 

3. 1 External Environment 

3.1.1 Introduction 

It is important to define the radiation environment of a mission early in the design cycle. 
During the mission definition phase it is an element of trade-offs for orbit selection. 
When the mission is defined, the knowledge of the radiation environment will allow the 
estimation of the effort that shall be put into hardness assurance. The important mission 
definition information that is necessary to define accurately the radiation environment is: 

- Orbital parameters of the mission allowing unambiguous definition of 
spacecraft orbit. 

- Worst case number of transfer orbits, with their individual orbital parameters. 

- Foreseen epoch for launch. 

- Mission duration. 


3.1.2 Environments 

The Earth space radiation environment is presented in detail in the first section of this 
short course. The reader interested in more details about the space radiation environment 
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should look at that and also at [Bart 97], The three main sources of radiation that have to 
be considered are: 

- The trapped electrons and protons in the radiation belts. 

- The protons and heavy ions produced by the Solar Particle Events (SPE). 

- The Galactic Cosmic Rays protons and heavy ions. 

The plasma sphere environment is generally not a hazard to most spacecraft electronics. 
However it is damaging to surface materials and differentials in the plasma environment 
can contribute to spacecraft surface charging and discharging problems [Holm 93]. 

Other radiation sources need to be considered for some specific missions or systems (for 
example, the neutrons resulting from the energetic particle interactions with the 
atmosphere in the case of low-altitude missions). 


3.1.3 Trapped radiation belts models 

The standard models of radiation belt energetic particles are the AE-8 and AP-8 models 
for electrons [Vett 91] and protons [Saw 76], respectively. The AP-8 model for protons 
gives proton fluxes from 0.1 to 400 MeV while the AE-8 model for electrons covers 
electrons from 0.04 to 7 MeV. These models give omni-directional fluxes as functions of 
idealized geomagnetic dipole coordinates B/B 0 and L (B is the magnetic field strength 
and L is the value that marks the particle drift shells by their magnetic equatorial distance 
form the center of the Earth). They are used with an orbit generator and a geomagnetic 
field computation to give instantaneous or orbit-averaged fluxes. The user defines an 
orbit, generates a trajectory, transforms it to geomagnetic coordinates, and accesses the 
radiation belt models to compute the flux spectra. Apart from separate versions for solar 
maximum and solar minimum, there is no description of the temporal behavior of fluxes. 
The trapped particle models represent omnidirectional, integral intensities that one would 
expect to accumulate on average over a six months period of time [Bart 97], For limited 
durations, short-term excursions from the model’s averages can reach orders of 
magnitude above or below. For example, at high altitudes in particular (e.g. around 
geostationary orbit) fluxes vary by orders of magnitude over short times and exhibit 
significant diurnal variations; the models do not describe these. In addition, the models 
do not contain any explicit flux directionality. 

At low altitudes, on the inner edge of the radiation belts, particle fluxes rise very steeply 
with altitude and small errors in computing locations can give rise to large errors in 
particle fluxes. This is a problem since the geomagnetic field is shifting and decaying so 
that the situation is no longer the same as when the model data were acquired. Use of a 
geomagnetic field model other than the one used in generating the model can result in 
large flux errors at low altitude. Therefore, the models should only be used together with 
the geomagnetic field models shown in Table 1 [Bart 97]. 

Although the use of an old field model and epoch can reduce errors in the magnitudes of 
fluxes, it should be noted that this does not model the spatial locations of radiation-belt 
features (e.g. the position of the South Atlantic Anomaly (SAA)), or particle fluxes, as 
they are today. This error is usually averaged out when the fluence is orbit integrated over 
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a period of 24 hours or greater but it can result in errors when specific positions in space 
are analyzed. 


Table 1 : Standard field models to be used with radiation belt models 


Radiation-belt model 

Geomagnetic field model 

AE-8-MIN 

Jensen-Cain 1960 

AE-8-MAX 

Jensen-Cain 1960 

AP-8-MIN 

Jensen-Cain 1960 

AP-8-MAX 

GSFC 12/66 extrapolated to 1970 


Figures 2 and 3 show examples of trapped electrons and protons spectra, respectively. 
These examples are for a 590 km altitude and 29 degrees inclination orbit with a mission 
duration of 5 years. 


Orbit Integrated Integral Trapped Electron Finance 
HST: J«29deg, H-59O/590 km, Launch in 21)01, 5 yean mission (4max ♦ Imln) 



Orbit Integrated Integral Trapped Proton Flue nee 
HST: l«29deg,H«590/590 km, Launch In 2001, 5 years mission (4 max ♦ 1 min) 
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At low altitude (< 1000 km), actual measurements of the trapped protons fluxes are 60 to 
500% higher than those predicted by the AP8 models. Daly [Daly 96] determined that a 
large part of this error is due to the method used to interpolate between the B/B 0 values in 
the regions near the atmospheric cut-off. Huston [Hust 98] analyzed environment data for 
the TIROS/NOAA satellite in order to produce a low altitude proton model based on 
coordinates more applicable to this region in space and also a more accurate 
representation of the effect of solar cycle modulation. Figure 4 compares the AP8 models 
and the Huston model orbit averaged proton fluxes measurements from 1986 to 1996 for 
the Hubble Space Telescope (HST) orbit (690 km circular orbit, 29 degrees inclination). 
We can see that the AP8 model underestimates the proton flux by at least a factor of 3 for 
this orbit. One may want to use this model in order to apply correction factors on the 
AP 8 -model. 


TIROS/NOAA proton flux measurements 

| — i — E>15 MeV E>30 MeV E>80 MeV -AP8 E>1S MeV AP8 E>30 MeV APS E>80MeV ] 



Figure 4: Comparison of the Huston model 
with the AP8 model, for the HST orbit. 


3.1.4 Solar Particle Event models 

3.1.4.1 Standard models for mission integrated proton fluences 

During energetic events on the Sun, large fluxes of energetic protons are produced which 
can reach the Earth. Solar particle events, because of their unpredictability and large 
variability in magnitude, duration and spectral characteristics, have to be treated 
statistically. Two models are available: 

- The JPL-1991 model [Feyn 93], 

- The Emission of Solar Proton (ESP) model [Xaps 00]. 
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The JPL-1991 model is based on data from solar cycles 20, 21 and part of 22. The ESP 
model incorporates the whole 3 cycles, which tends to make predicted proton fluences 
slightly higher, as shown in Figure 5. The JPL-1991 model provides data up to 60 MeV. 
The ESP model extends this energy range up to 300 MeV and therefore covers all the 
energy range of interest. 

These models are the standard models used for engineering consideration of time- 
integrated effects. Since these are statistical models, a probability level needs to be 
entered. Table 2 gives the recommended confidence levels in function of the mission 
exposure to solar maximum conditions. They are based on an analysis of worst-case 
periods [Tran 92]. 


Table 2: Recommended confidence levels as a function of the number of years of 


Number of years 
of exposure 

Probability level 
(%) 

1 

97 

2 

95 

3 

95 

4 

90 

5 

90 

6 

90 

7 

90 


Figure 5 compares the 2 models for the 90% confidence levels. The ESP model is the 
standard model used at NASA-GSFC. 


Solar protons, comparison of JPL91 and ESP model 



— ESP>1MeV 
— ESP>10 MeV 
-* ESP>30 MeV 
ESP>60 MeV 
— ESP>100MeV 

ESP>200MeV 

— ■ — ESP>300 MeV 

♦ JPUIMeV 
A JPL>10MeV 
■ JPL>30 MeV 

• JPU60MeV 


Figure 5: Comparison of the ESP and JPL-91 models for a 90% confidence level [Xaps 00]. 
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3.1.4.2 Spectrum of individual proton events 

The August 1 972 event produced a peak flux near the Earth in excess of 1 0 6 protons cm' 2 
s’ 1 above 10 MeV energy, while the October 1989 event produced a peak flux of about 
10 5 protons cm' 2 s' 1 . The fluence spectra of these 2 events are generally used to represent 
a worst-case proton event classified as extremely large [Stas 96]. For Single Event Upset 
analysis, the October 1989 model integrated in CREME 1996 is the standard model. 

Burrell developed a modified Poisson statistics to describe the probability p of a number 
of events n occurring during a time t [Kin 74]. This is sometimes useful in considering 
numbers of events in contrast to the total fluence. Generally during 7 years of Solar 
maximum activity, no more than 5 extremely large events could occur with a 90% 
confidence level. 

A probability model for worst-case solar proton event fluence has also been integrated in 
the Emission of Solar Proton model (ESP) [Xaps 99-1]. 


3.1.4.3 Solar particle event ions 

The CREME96 model is the standard model for Solar Particle Event ions. CREME96 
contains models based on the October 1989 event. It provides models of energy 
spectrum, composition and LET spectrum for the worst week, worst day and peak 5 
minutes [Tylk 97]. 


3.1.5 Galactic Cosmic Rays environment models 

Cosmic Ray environment models were originally created by Adams and co-workers at 
the US Naval Research Laboratory [Adam 86], under the name CREME. They provided 
a comprehensive set of Cosmic Ray and Solar event ion LET and energy spectra 
including treatment of geomagnetic shielding and material shielding. CREME has been 
superseded by CREME96 [Tylk 97]. The major differences are in the inclusion of a 
model of the Cosmic Ray environment and its solar-cycle modulation, improved 
geomagnetic shielding calculation, improved material shielding calculation and more 
realistic Solar Energetic Particle Event ion environments. Cosmic ray fluxes are anti- 
correlated with solar activity so the highest cosmic ray fluxes occur at solar minimum. 
CREME 96 is the standard model for cosmic ray environment assessment. Ions from Z=1 
to 92 should be included to define the mission GCR environment. 


3.1.6 Spacecraft secondary radiation 

Secondary radiation is created by the transport of primary particles through the spacecraft 
materials. For engineering purposes it is often only electron-induced bremsstrahlung 
radiation that is considered as a significant secondary radiation source. In special cases 
other secondaries need to be considered. 
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In evaluating the radiation background effects in detector systems, it is often secondary 
radiation that is important [ECSS 00]. Most radiation is emitted at the instant of 
interaction (“prompt”) while some is emitted some time after a nucleus has been excited 
by an incoming particle (induced radioactivity). 

By its nature, secondary radiation is analyzed on a case-by-case basis, possibly through 
Monte-Carlo simulations. For engineering estimates of bremsstrahlung, the SHIELDOSE 
[Selt 80] model can also be used. 


3.2 Environment within the Spacecraft 
3.2.1 Introduction 

In engineering a space system to operate in the space environment, it is necessary to 
relate the environment to system degradation quantitatively. The Table 3 gives the 
parameters that should be determined for quantification of the various radiation effects. 
Although some of these parameters are readily derivable from a specification of the 
environment, others either need explicit consideration of test data or the detailed 
consideration of interaction geometry and mechanisms. 

It is very important to define accurately the radiation levels within a spacecraft. Over 
specification leads to unnecessary costs and delays, under specification may involve very 
expensive retrofits or compromise the mission. 


Table 3: Parameters for quantification of radiation effects. 


Radiation effect 

Parameter 

CMOS Electronic component 

degradation 

Total ionizing dose (TID) 

Bipolar Electronic component 

degradation 

T1D and Displacement Damage Dose 
(DDD) or equivalent fluence for a 
selected proton energy 

Material degradation 

TID and DDD or equivalent fluence 
for a selected proton energy (bulk 
damage) 

Opto-electronic component degradation 

TID and DDD or equivalent fluence 
for a selected proton energy 

Solar cell degradation 

Displacement damage equivalent 
fluence for a selected electron/proton 
energy or DDD 

Single Event Effect (SEE) 

Ions LET spectra, proton energy 
spectra 

Sensor interference (background signals) 

Flux above energy threshold or flux 
threshold 

Internal electrostatic charging 

Electron flux and fluence 
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3.2.2 Total Ionizing Dose (TID) 


3.2.2.1 Introduction 

Total dose levels to be received at component die level are calculated for active parts, 
taking into account spacecraft shielding. Figure 6 shows an overview of a radiation 
transport analysis. Total dose simulations can be performed either using 3 D sector based 
codes or 3D Monte Carlo transport codes. Sector based codes are simple to use and 
provide results with low computation time while Monte Carlo codes are time consuming 
but much more accurate. Monte Carlo techniques numerically plot the trajectories of 
large numbers of particles and predict their interactions in the material through which 
they are traveling. Interactions usually have a distribution of possible outcomes to which 
random sampling is applied. For electrons, successive interactions are too numerous to 
follow individually; instead, attention is given to a small section of the electron’s path 
containing a large number of individual interactions. The net result of all the interactions 
can be expressed analytically and at the end of each section, the electron energy loss is 
computed and its direction is altered by random sampling of a scattering distribution. The 
section length is chosen such that the energy loss in the section is a small fraction of the 
electron energy. 



Figure 6: Radiation transport analysis overview, from [Daly 1989], 


Monte Carlo techniques can also be used to compute the transport and interaction of other 
particles and their secondaries, including bremsstrahlung and neutrons. 
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Even when a Monte-Carlo analysis is performed, a dose-depth curve is calculated to 
define the top-level requirements at the beginning of the program. 


3.2.2.2 Top level estimation, dose depth curve 

The top-level ionizing dose environment is represented by the dose depth curve. This can 
provide dose as a function of shield thickness in a planar geometry or as a function of 
spherical shielding about a point. The spherical model gives a conservative estimate of 
the dose received. The planar model is appropriate for surface materials or for locations 
near to a planar surface [ECSS 2000], In general electronic components are not in such a 
location and a spherical model is recommended for general specification. Figure 7 
illustrates two typical ID sphere geometries: the solid sphere model and the shell sphere 
model. 



Figure 7-a : Solid sphere I-D shielding model. 

The dose depth curve D(r) based on solid sphere 
gives the total dose to be received at center 0 of an 
A1 solid sphere (0,r), when inside a given radiation 
environment. 



Figure 7-b : Shell sphere 1-D shielding model (Y,Z plan). 
The dose depth curve D(r) based on shell sphere gives the 
total dose to be received at center O of the aluminum shell 
having center O, radius R and thickness r, when inside a 
given radiation environment. 


The dose depth curve could be calculated either with a Monte Carlo code or with the 
SHIELDOSE model. The SHIELDOSE model is based on a large data set containing the 
dose per unit of incident fluence as a function of depth of Aluminum shielding and 
particle energy [Seitz 80], Datasets have been collected with Monte Carlo codes on 
simple geometries (e.g. slab, solid spheres). NOVICE [Jord 1982] is an example of a 
Monte Carlo code widely used in the industry for radiation analysis. GEANT4 is also a 
Monte Carlo code that is used [Trus2000], SHIELDOSE2 is integrated in the 
SPACERAD and SPENVIS radiation analysis computer tools. 


The dose depth curve allows the definition of a top-level dose requirement for a specific 
mission assuming a conservative shielding thickness, for example 100 mils of Aluminum. 
This could be adequate for a low dose environment mission but generally the dose levels 
obtained are too high and a more accurate analysis is needed. Figure 8 shows the dose 
depth curve of the ST5 mission (elliptical orbit 200-35790 km altitude, 0 degree 
inclination and three months duration). The Figure shows the contribution of the different 
environments (trapped electrons and protons, solar protons and the bremstrahlung) to the 
total dose. We can see in the figure that for this mission the electrons dominate the TID 
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environment up to 250 mils of shielding and that they are nearly completely eliminated 
after 350 mils of shielding. 

Total dose at the center of Solid Aluminum Sphere 
STS: 200-35790 km, 0 degree Inclination, three months 



Aluminum shield thickness (mils) 


Figure 8: Example of a dose depth curve. 


3.2.2.3 Sector Based analysis 

The sectoring method traces rays through the shielding in a large number of directions. A 
sector based analysis needs two inputs, the 1 dimension dose depth curve and the 3 
dimension structural model of the materials surrounding the sensitive component. The 
output of the sector based analysis is the total dose received at the sensitive component 
die level. 

The ray trace methodology consists in calculating the dose at the center (called the 
detector in the following) of a parallelepiped. Ray tracing calculations follow the 
procedure described below: 

- Each face is meshed N 1 x N2 (9 min < Ni < 20), 

- M rays are launched from the detector, in the direction of a point of the 
meshing. The number of rays shall be at least 15 per mesh. For each ray k, 1< 
k < M, the thickness of every surface encountered by the ray k is added and an 
equivalent Aluminum thickness tjjk is then calculated. For each mesh element 
(i j), (1< i <N1, 1< j <N2) a mean value tjj is determined: 

1 M 

** = ~M 

From this value, the mean dose dij received per target through the mesh element (i j) is 
deduced from the dose depth curve (which gives value over An steradians): 
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°ij is the solid angle with the mesh (i j) as the base and the detector as the top. The dose 
d received on a face is the sum of the dose received on each mesh of the face: 

NX N 2 

= X I*, 

1 /-l 

From this dose is deduced an equivalent thickness " t " from ID dose depth curve D(t): 

4 nd 
D(f) = — 
a 

Ml M2 

with = X Z n a 

i - 1 J-l 

2 techniques are possible to determine the thickness t crossed by a ray for an elemental 
sector: the NORM technique and the SLANT technique as described in Figure 9. 




propagation 

encountered 

Figure 9: NORM and SLANT techniques for sector based analysis. 


These two techniques lead to significantly different estimates of shielding thickness. As 
demonstrated by MonteCarlo validations and an analysis on ionizing particle transport, 
there is a limited range of application for each of these techniques [Astr 01]. Protons 
propagate in straight line, and proton shielding calculation can be performed using the 
SLANT method, while electrons propagate in an erratic way and electron shielding 
calculation need to be performed using the NORM technique. 


When a ID dose-depth curve is calculated with the shell sphere model, the sector analysis 
should use the NORM technique. When the solid sphere model is used, the sector 
analysis should use the SLANT technique. If this is not done, underestimations of the 
dose levels could result. 


Figures 10 and 1 1 compare the results obtained with the 2 techniques for a geostationary 
and a low polar orbit environment respectively with a Monte Carlo analysis that gives the 
most accurate estimation. The dose levels have been calculated on a target within a 
package, within an electronic box in a spacecraft. The spacecraft and the box structures 
have been modeled. The same model has been used for the three different analyses. The 
shielding provided by the spacecraft and the electronic box is in the range of 2 to 4 g/cm 2 , 
which is representative of the shielding provided to most of the electronic parts used in a 
spacecraft. Four kinds of electronic parts packages have been analyzed: a metal T039 
package, a ceramic CQFP package, a plastic TSOP package, and a Radiation hardened 
package made of different layers of heavy and light materials. 
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The results show that the different analyses give significantly different results on an 
electron-dominated orbit like the geostationary case. The sector analysis could 
significantly overestimate or underestimate the dose levels. 

For proton-dominated orbits like the LEO case, the effect of the analysis method is less 
significant. An accurate sector analysis will give a result within +/- 10% to the actual 
dose level. 


GEOSTATIONARY ORBIT 

| 13 Monte Carlo ■ sectorial analysis, shell sphere/norm model M sectorial analysis, solid sphere/slant model | 

35 7 ! 



T039 CQFP TSOP RadPack 

Package type 


Figure 10: comparison of the results obtained with three different 
methods for a geostationary orbit [Astr 01]. 


3.2.2.4 3D Monte Carlo analysis 

The 3D Monte Carlo analysis method gives the best estimate of the deposited dose. This 
is the method used and recommended by NASA-GSFC. However, the accuracy of the 
calculation depends on the number of particles that hit the target in the simulation. An 
acceptable level of accuracy is reached when a minimum of 1024 particles hit the target. 
Such a calculation may take a considerable amount of time (in the order of days), because 
a significant amount of particle needs to be analyzed in order to get 1024 that reach the 
target. A reverse Monte-Carlo code, like NOVICE, starts the analysis from the target and 
goes back to the external environment; so only 1024 particles need to be analyzed. This 
type of code will give accurate results significantly faster. 


To be presented at the IEEE NSREC 2002 short course, Phoenix, July 2002 

V-15 



LEO ORBIT {820 km/90 degrees) 


u . :r na i >:.’i*sK'?;5 sfi**. ■ vfclcj".-.; rir-=i*-^ = ;.>:i i r.:»vi *•»•««'!! tr* ^ 



T039 


CQFP TSOP 

Package type 


RadPack 


Figure 1 1 : comparison of the results obtained with three different 
methods for a LEO polar orbit [Astr 2001]. 


3.2.3 Single Event Effects 

Once the GCR spectra have been transported through a given value of shielding, changes 
of the shielding thickness do not have a significant effect on the GCR fluxes. But it could 
have an effect on solar event particles fluxes. Shielding also has a limited effect on 
protons of energy greater than 30 MeV. For single event studies the heavy ion LET 
spectra and proton energy spectra are calculated for a conservative value of shielding. At 
NASA-GSFC the spectra are calculated for an Aluminum shielding of 100 mils (2.54 
mm). The European Space Agency recommends assuming a lg/cm* of Aluminum (3.7 
mm) [ECSS 00], Figure 12 shows an example of GCR and SPE LET spectra for an 
interplanetary orbit. We can see that the heavy ion fluxes during SPE are significantly 
higher than the GCR background fluxes. 

A spacecraft goes through the trapped proton belts during only a portion of the whole 
orbit. Therefore, an orbit averaged trapped proton flux does not describe correctly the 
trapped proton environment. For SEE analysis, the peak fluxes that correspond to the 
worst-case pass through the Van Allen belts need also to be calculated. Figure 13 shows 
an example of average and peak trapped proton energy spectra, indicating that these can 
differ by orders of magnitude. 
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Integral LET Spectra at 1 AU (Z=1-92) for Interplanetary orbit 
100 mils Aluminum Shielding, CREME96 



1.00E-03 1.00E-02 1.00E-01 1.00E+00 1.00E+01 

LET Energy (MeV-cm 2 /mg) 

Figure 12: Example of GCR and SPE LET spectra. 


1.00E+02 


1.00E+03 


Trapped Proton Integral Fluxes, behind 100 mils of Aluminum shielding 
ST5: 200-35790 km 0 degree Inclination , Solar maximum 



Figure 13: Example of average and peak trapped proton flux spectra. 
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3.2.4 Displacement Damage 
3. 2.4.1 Introduction 

In general most of the displacement effect damage in the space radiation environment is 
due to protons [Mars C 99], In the particular case of solar cells used on solar panels, the 
only shielding between the solar cell and the external environment is a thin (as thin as 30 
pm) coverglass coating, and the electron contribution needs to be considered in addition 
to the proton contribution. 


3.2.4.2 Determination of the Damage radiation environment for a 
mission 

Generally for a top-level requirement, an arbitrary value of shielding is considered (i.e. 
100 mils). When a more accurate analysis is needed, an “equivalent” shielding could be 
derived from the dose analysis and then the particle spectra could be calculated for this 
shielding. Otherwise the particle spectra at a specific part location could be calculated 
with a Monte-Carlo code. Then the DDD or the mission equivalent fluence for a given 
proton energy is calculated using the Non Ionizing Energy Loss (NIEL) rate [Hopk 96, 
Mars C 99]. To first order there is a linear relationship between the device degradation 
from particle induced displacement damage and NIEL for a variety of particles, electrical 
parameters and devices materials [Mars C 99], The DDD or the equivalent proton fluence 
is calculated as follows: 

DDD = If(E)N(E)AE 

Mission equivalent proton fluence, F D = I f(E)N eo (E) AE 


Where 

f[E) is the differential fluence spectrum 
N(E) is the NIEL for a particle energy E 

Neo(E) is the NIEL for a proton energy E normalized to the enerev E0 
(N eo (E)=N(E)/N(E0)) 

AE is the energy step of the sum 

Generally only the protons are considered, but if electrons need also to be considered 
(like in the case of solar cells), the contribution of the different particles is added. NIEL 
values have been calculated for the following materials: Si, GaAs, InGaAs, and InP. 
Cheryl Marshall discusses the limitations of the NIEL concept in [Mars C 99], Generally 
the NIEL overestimates the displacement damage degradations at high energy, and 
underestimates the device degradation at low energy. 

Figure 14 presents the 10 MeV proton equivalent fluence for a Silicon material for the 
ST5 mission (elliptical orbit 200-35790 km altitude, 0 degree inclination and three 
months duration). For this orbit, the maximum contribution of electrons at low shielding 
is 30% and it is completely negligible after 150 mils of shielding. For the same mission, 
the electrons dominate the TID environment up to 250 mils of shielding (see Figure 8). 
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NIEL Proton 10 MeV equivalent fiuences 
ST5: 200-35790 km, 0 degree inclination, 3 months 



-trapped protons 
- solar protons 
-electrons 
“total 


Aluminum shielding (mHs) 


Figure 14: NIEL equivalent proton 10 MeV fluence versus Aluminum shielding. 


3.2.4.3 Solar cell degradation 

Calculation of DDD or equivalent fluence based on the NIEL can also be made for solar 
cells. But generally, engineers use models based on measured damage coefficients: the 
EQRFRUX-Si and the EQRFRUX-Ga models for Silicon and Gallium Arsenide solar 
cell degradation calculations, respectively [Tada 82, Ansp 96]. Marvin has also recently 
measured damage coefficients for multi-junction solar cells [Marv 00]. The solar cells 
models give a 1 MeV electron or a 10 MeV proton mission equivalent fluence. 

These models consider a given thickness of coverglass and assume by default an infinite 
back-side shielding of cells. But if necessary, a calculation of radiation penetration 
through the rear-side of solar arrays could be done with a transport code. 


4.0 BOUND THE PART RESPONSE 


4.1 Introduction 

Knowledge of the radiation sensitive parts is essential to the overall hardness assurance 
program. However in planning characterization tests, maximum use can be made of part 
characterizations performed on other programs. Radiation testing is expensive and should 
be avoided when possible. A careful literature search and analysis can circumvent 
unnecessary tests. If there is no available radiation data or if the test data is not sufficient, 
radiation test data must be obtained. 
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The objectives of radiation testing are threefold: 

- Understand the mechanisms of interaction of the radiation with electronic 
materials and how these effects relate to device failure. 

Characterize the response of specific device types and technologies for use in part 
selection for specific system application. 

Determine the acceptability of production lots. 


These three categories of testing can be considered research, characterization, and 
hardness assurance. In order to obtain the database needed for these three objectives, the 
space radiation environment must be simulated in the laboratory. Although attempts are 
often made to duplicate the space environment to the greatest extent possible by 
irradiating with the same particle type, energies, and fluxes encountered in space, more 
often the dominant effect of the radiation is simulated with a convenient radiation source 
to reduce the cost and technical problems. 

For the total dose environment, the damage is caused by the ionization energy absorbed 
by the sensitive materials, measured in rad. This implies that a number of ionization 
sources can be used for simulation. However the total dose response is also a strong 
function of the dose rate. 

The single particle environment is usually simulated by the particle LET. For heavy ions 
this seems to be a reasonable measure of the environment as long as the particle type and 
energy are adjusted to produce the appropriate range of the ionization track. For protons, 
however, the LET is not the primary parameter since the upsets result primarily from 
secondary particles resulting from the interaction of proton with device’s atoms. Thus for 
the proton environment, the simulations must be conducted with protons of the 
appropriate energy. 

Displacement damage can be simulated for any particle by using the value of NIEL. This 
implies that the effects of the displacement are to a first approximation, only proportional 
to the total energy loss through displacements and not on the nature of the displacements. 

Although the radiation facilities used to simulate the environment are a major factor in 
radiation testing and are source of large uncertainties [Stas 91], another important factor 
is the simulation of the operating conditions of the devices. The failure mechanisms of 
many microelectronic devices exposed to radiation are a strong function of the operating 
bias, operating mode (standby or active), and temperature. Devices are usually 
characterized under a variety of test conditions in order to find the worst case operating 
conditions. 1 ° 

The temperature of many space electronics systems is controlled to be within a range of 
0-80°C. Failure levels within this range usually do not vary significantly from room 
temperature, where most radiation testing is performed. There are some space 
applications, however, where temperature extremes are encountered, such as cryogenic 
electronics for certain detectors and high temperatures for some space power systems. In 
these cases, the failure levels can be significantly different from those measured at room 
temperature, and the testing must be performed at the appropriate temperature. 
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4.2 Use of existing Radiation Data 

There are many sources of radiation data on semiconductor devices and microcircuits. 
Many agencies offer radiation effects databases on the web: 

NASA-GSFC radiation effects data base ( http://radhome.gsfc.nasa.gov/top.htm ) 
NASA-JPL radiation effects data base (http://radnet.ipl.nasa.gov ) 

DTRA ERRIC radiation effects database ( http://erric.dasiac.com/ ) 

ESA radiation effects database (https://escies.org/ ) 

The IEEE NSREC data-workshop proceedings, IEEE Transactions on Nuclear Science 
and RADECS Proceedings are also useful sources of information. Some manufacturers 
make available the radiation data about their products. 

The existence of radiation data on a device does not necessarily indicate the device’s 
acceptability. Most of the available data is either out of date, not well documented (in 
terms of bias conditions, radiation source characteristics or measurement techniques) or 
peculiar to nuclear weapons rather than the space environment. For many commercial 
parts the design is changed, the feature size is shrunk and the process is improved in a 
continual effort to improve performance, yield and reliability. Many of these changes 
affect the radiation response. 

General guidelines for acceptability of archive data are: 

- The tests have been performed with the approved US or European test 
procedures (see next chapter). For linear devices, if the part has been tested to 
TID at high dose rate, retesting is recommended. 

A sufficient number of parts has been tested. 

The tested part has the same technology as the part that will be used for flight. 
For TID data, if the lot date code is different, testing is recommended, but may 
be waived if sufficient process information is gathered. Acceptable conditions 
for a testing waiver are similar Lot (or date code) with known process changes, 
or devices for which the die topology and substrate characteristics are known to 
be the same as for an older lot of devices. 

The electrical parameters/performances important for the application have been 
tested. 

The bias conditions during testing are worse or equivalent to the application. 

The two last steps are perhaps the most difficult. A good example is evaluating test data 
for SET in linear circuits. In this case, an understanding of what the sensitive SET 
characteristics (amplitude and duration) are in a design’s application is required. 


4.3 Testing 

4.3.1 Total Dose Testing 

Total dose testing is performed by exposing a device to an ionizing radiation environment 
and by measuring its electrical performance for a variety of operating conditions. There 
are two approaches that can be used to characterize the response: step stress and in-flux 
testing. Step-stress testing is performed by first characterizing the electrical performances 
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of the device, exposing it to a fixed dose of ionizing radiation, and then measuring again 
the electrical parameters to determine their change. To determine the device response 
versus total dose, the test is performed with different samples of the same type at a 
number of accumulated dose levels. In-flux testing is performed by continually 
measuring the device response as it is being irradiated. The step stress approach is usually 
more convenient and much more widely used. 

Figure 15 shows the dose rate ranges of the space environment, the different types of 
irradiation facilities and the recommended ranges in test standards. We can see that the 

space dose rate is typically lower than 10' 3 rad/s, and the laboratory dose rates are several 
orders of magnitude higher. 

Generally the ionizing radiation environment is simulated with 1.25 MeV y-rays (Co 60 ) 
even though the radiation space environment consists primarily of electrons and protons 

of various energies, y-rays give a conservative estimate of the space radiation 
environment [McLe 87], 



Dose rate (rad(Si)/s) 

Figure 15: Dose rate and simulation, comparison of the dose rates found in 
the radiation environments and the rates used in the testing of components 
for tolerance to cumulative exposure [Holm 93]. 

Since the parts are used in different conditions in a spacecraft, they are generally biased 
during testing in the conditions that give the worst-case damage. ' 

Test standards have been developed in the US (MIL-STD 1019.5 and ASTM FI 892) and 
in Europe (ESA/SCC 22900). These standards define the requirements applicable to the 
irradiation testing of integrated circuits and discrete semiconductors. The MIL-STD 
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1019.5 procedure was written for military applications and has been adapted for space 
applications. The European procedure is only applicable to space applications. Both 
procedures define the test conditions in order to get a conservative estimate of the part 
radiation sensitivity of CMOS devices, but in different ways [Wino 93]. There are two 
areas in which the 1019.5 and the SCC22900 differ. There are first the dose rate, then the 
dose and the interface trap build-up simulation: 

- Dose rate : The standard dose rate window of the MIL-STD 1019.5 (50 to 300 
rad/s) is significantly higher than the ones of ESA/SCC22900 (1 to 10 rad/s for 
the standard window and 0.01 to 0.1 rad/s for the low dose rate window). Both 
specifications permit the testing at lower dose rates, as long as the dose rate is 
higher than the dose rate of the intended application. The MILSTD 1019.5 leads 
to a more conservative measure of the failure dose. However the MIL STD 
1019.5 allows room temperature bias anneals following irradiation in order to 
take advantage of oxide -trapped charge annealing and provide a less 
conservative measure of the failure dose for the space environment. 

- Dose level and interface trap build-up simulation : Both procedures include a 
one week elevated temperature (100°C) anneal test after the irradiation in order 
to get a worst case testing of both the trapped holes and interface trap 
mechanisms, but the details of the test differ. TM 10 19.5 calls for an additional 
irradiation to 0.5 times the specification prior to elevated temperature annealing 
and electrical test. The additional irradiation to 0.5 times the specified dose is 
required because of the uncertainty in defining worst-case bias during 
irradiation and anneal. To compensate for this uncertainty, a margin is provided 
in the form of additional dose. ESA/SCC 22900 does not require an additional 
irradiation to 0.5 times the specified dose, but instead seeks to accurately 
identify worst-case bias conditions. TM 10 19.5 is more conservative due to the 
overtest. ESA/SCC22900 calls for an additional 24 hours room temperature 
biased anneal prior to the elevated temperature anneal. This additional anneal 
contributes in fact a little toward extending the time frame of measurement 
toward the space application [Wino 93], but it is an allowance to perform 
irradiation in another location than the testing facility. 

Many linear bipolar circuits exhibit enhanced low dose rate sensitivity (ELDRS) [Beau 
94, McCl 94, John 94, John 95]. For those circuits MIL-STD1019.5 and ESA/SCC 22900 
test procedures may be non-conservative, because the accelerated aging test does not 
work [Peas 96]. This is why bipolar technology is specifically excluded from the 
TM1019.5 accelerated aging test. Several accelerated tests for bipolar microcircuits have 
been suggested. Generally they propose high dose rate irradiation tests at elevated 
temperature [Witc 97, Peas 96-2, Bono 97], but to date no successful standard test 
procedure has been found to bound the part response of all types of bipolar linear circuits. 
For each part type, there is an optimum dose rate and temperature that depends on the 
dose level. This is illustrated in the example in Figure 16 where the degradation versus 
dose of the bias current of a LM31 1 voltage comparator is shown for different dose rate 
and temperature values. We can see that the 100 C temperature and 5.5 rads/s irradiation 
condition provides a little enhancement to the high dose rate (28 rad/s) irradiation at room 
temperature. But the 100 C temperature and 0.55 rad/s irradiation condition gives a very 
good fit of the low dose rate test (8 mrad/s) up to a dose of 50 krad.. 
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The only approach to take is to perform a low dose rate test. This approach is very time 
consuming and is generally not compatible with the timeframe of a space project. For 
example about one year of irradiation at 1 mrad(Si)/s is required to reach a dose level of 
30 krad. Fortunately, most low dose rate sensitive parts show a saturation of the enhanced 
responses at dose rates below a value determined by the most sensitive transistor type for 
the parameter of interest. For some part types this may be at about 1 rad/s and for others 
it may be between 1 and 10 mrad/s. The test method ASTM FI 892 proposes an approach 
for the hardness assurance test of bipolar linear devices [Peas 01-2], The flow diagram is 
shown in Figure 17. The first step is the review of existing data to determine if the device 
is sensitive to ELDRS. To date about 25 widely used bipolar linear circuit types have 
demonstrated low dose rate sensitivity [Peas 96-3, Peas 01-3], If no data exists an initial 
test is performed to determine low dose rate sensitivity. It consists in a baseline high dose 
rate test at room temperature and a low dose rate test (the ASTM FI 892 suggests a dose 
rate at least three orders of magnitude lower than the high dose rate) If the part is not 
sensitive to ELDRS, the standard TM1019.5 is applicable. If the part is sensitive to 
ELDRS, two approaches are proposed: 



values of dose rate and irradiation temperature [Carr 00]. 
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Figure 17: ASTM FI 892 ELDRS flow diagram [Peas 01*2] 

The first is a pragmatic hardness assurance testing approach using reasonably low dose 
rates and recommending higher Radiation Design Margins than the ones used for CMOS 
devices [Peas 98, LaBe 98]: 

- Low dose rate at 10 mrad/s with the standard design margin of 2. 

Elevated temperature irradiation at 100°C and a dose rate of about 1 rad/s with a 
design margin of 3 (up to 50 krad). 

This approach is simple, but there is a risk of not bounding the low dose rate response of 
the part with these tests. The second approach is an exhaustive one with many different 
test conditions to define the adequate test condition for this part. 

The ESA/SCC requires a minimum of 1 1 test samples (10 irradiated parts + 1 reference 
part). No sample size is indicated in the MIL-STD 1019.5, but the MIL RHA 
requirements are: 4 parts (0 defect) per wafer in class S and 22 parts (0 defect) per 
inspection lot in class B. A study performed for the development of the last issue of 
ESA/SCC 22900 showed that 10 parts are a minimum sampling size for an adequate 
characterization of commercial parts and bipolar linear devices [Carr 95]. 

Even a slight variation on the process may have a significant effect on the total dose 
response. On bipolar linear devices the variation could be important within a single lot 
and between different lots as illustrated in Figure 21. On COTS devices where there is no 
information on the process changes, a large variability of the total dose response has been 
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observed [Peas 96], For these devices, when there is not a sufficient design margin, it is 
recommended to test the flight lot. 

Other factors have also been shown to have a significant effect on the total dose response: 
Bum-in [Shan 94], packaging [Clar 95, Dowl 93] and the combination of these two 
elements. These effects have been studied for several years but are still not completely 
understood. Therefore the test should be performed not only on parts representative of the 
flight parts but also with the same packaging and preconditioning. 


4.3.2 Single Event Effect testing 
4.3.2.1 Introduction 

Single Event Effects testing is performed using the in-flux test method. The microcircuit 
is electrically exercised by a tester and the errors are counted during irradiation. 

High energy Galactic Cosmic Rays or Solar Event heavy ions are simulated with low 
energy ions available in particle accelerators. The index of quality used is the amount of 
energy lost per unit length of track, the linear energy transfer (LET). As the SEE sensitive 
regions of many microcircuits are relatively thin (several pm), ground testing is 
conducted using ions with lower energies than GCR or Solar Event heavy ions, but with 
similar LET. The energy range at the SEE facilities commonly used is of the order of 
several MeV/u (u is the atomic mass unit) and the penetration range of ions is about from 
30 pm for the heaviest particles to 100 pm for the lightest particles. Shortcomings of 
SEE ground testing have been discussed in several papers [Stas 91, Koga 96, Duze 
96,Poiv 01], Generally the LET concept gives a conservative estimate of part SEE 
sensitivity. As the range of ions available at ground level is low, these tests are performed 
under vacuum for low energy beams and the device package in front of the die is 
removed. At each value of LET the bit error rate is measured by counting a statistically 
significant number of errors. The SEE cross section in cm 2 (or cm 2 /bit) is the ratio of the 
measured number of errors to the ion fluence in particle/cm 2 . 

To allow a wider range of LET values with fewer ions, it is common practice to adjust the 
incident angle of the particle beam by rotating the device under test. For a thin sensitive 
volume with a constant LET through its depth, the path length increases as l/cos0, where 
0 is the incident angle. This does not change the LET of the ion but increases the path 
length by the secant of the angle. Thus, as long as these assumptions hold, the “effective 
LET” increases. Unfortunately this cosine law is not always applicable. It fails in several 
cases: 

- where charge collection occurs over a path length that is a sizable fraction of the 
total range of the particle (the LET varies along the path), 

- for devices that collect much of their charge by diffusion, 

- where the aspect ratio of the collection volume is small, causing a more 
complex angular dependence. 

The validity of the cosine law must be carefully checked for each device technology. Test 
results should always include angle and range data for each ion species. In addition to 
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these limitations, when the device is rotated, the device package could shadow the ions 
[Koga 96], 

When the effective LET concept is used, the SEE cross section is then calculated as 
follows: 

- effective LET, LET (0) = LET (0°)/cos6 

- cross section at the LET(0), cr = number of events/fluence*cos0 

The particle fluence is expressed in particle/cm 2 . The final result of the test is the cross 
section versus LET curve for each Single Event Phenomenon (SEP). 

The energy range of space protons is directly available on synchrotron accelerators at 
ground level. The testing is similar to the heavy ion test, but for protons it is the SEE 
cross section versus proton energy curve that is measured. The criterion for proton testing 
is based on heavy ion threshold LET for the relevant SEP studied. For silicon parts, the 
proton cross section is negligible when threshold LET as measured using heavy ion is 
larger than 15 MeVcm 2 /mg; no proton testing is required in this case. 

Because proton induced SEPs involve spallation products created after a nuclear reaction 
between proton and the device’s atoms, it is possible to estimate the proton sensitivity 
based on heavy ion data. Specific models [Roll 90, Pete 92, Douc 95, Calv 96, Miro 98, 
Bara 00] exist which allow an estimation of the proton induced SEE cross section curves 
based on heavy ion data. This approach can be used to get a first idea of the device 
sensitivity, but if this device is critical for the application, a proton testing 
characterization is recommended. 


4.3.2.2 Test standards 

Test standards have been developed in the US (JEDEC Test standard 57 or US ASTM 
FI 192-90) and in Europe (ESA/SCC25100). The JEDEC test standard 57 is only valid 
for heavy ions (Z>2). The ESA/SCC 25 1 00 is applicable for both heavy ions and protons 
testing. Both methods are similar, the main points are: 

- The microcircuits under test shall be delidded for heavy ion SEE testing. This is 
due to the limited penetration range of the ions available at the ground level. In 
most of the facilities, irradiation is performed under vacuum for the same 
reasons. The delidding is generally not required for proton SEE testing and the 
irradiation is performed in air. 

The ESA/S SC requires heavy ions with sufficient energy to deliver a particle 
range in Silicon greater than 30 pm (this is not required in the JEDEC 57 
procedure). This requirement is important because some modem microcircuits 
have multiple layers of metallization. In addition charge collection lengths are 
in the order of 15 to 20 pm for power MOSFETs [Stas 92] and linear devices 
[Peas 01]. 

Both test methods allow the use of the effective LET except for Single Event 
Burnout (SEB) testing of power MOSFETs. In the JEDEC TM, the maximum 
tilt angle is limited to 60°. 

Minimum fluence levels: 

10 ions/cm for soft errors and 10 ions/cm for hard errors for heavy 
ions, 10 10 protons/cm 2 for protons at the threshold. 
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- Fluence that will induce at least 100 events or 10 6 ions/cm 2 (10 10 
protons/cm 2 ) above threshold. 

- A minimum of 5 exposures (at different LET or proton energies) is required in 
order to get an accurate measurement of the cross section curve. 

- Monitoring of the dose levels received by the irradiated devices is required. 
This is particularly important for proton testing where the test fluences are high 
and therefore the dose levels. It is sometimes necessary to change the parts 
between the different experimental points. 

- The ESA/SCC 25 1 00 test method calls for a sample size greater than 3. 

- The JEDEC test standard addresses the specific case of the SEB test of power 
MOSFET where the response is a function of the drain source voltage (Vds) 
and the LET [Nich 96]. 


4.3.2.3 SEU testing 

In the past, single-event testing was relatively straightforward for memory testing. It was 
generally easy to define the internal conditions and to test the entire storage array of a 
memory circuit. The test flux just needed to be low enough to avoid complications from 
multiple errors during short time periods and to correct for the latency period during the 
time that the memory is being rewritten. But now, large commercial memories use more 
complex architectures that complicate the testing and make the interpretation of memory 
test results much more difficult. Now memories are not only sensitive to Multiple Bit 
Upsets induced by a single particle; they may also be sensitive to large error events [Poiv 
00] and also Single Event Functional Interrupt (SEFI) [Koga 01]. 

Other VLSI devices, such as microprocessors are also very difficult to test. In order to 
interpret results, one must know which regions of a device involve internal storage cells, 
and how many of them are being exercised during the test. For example, test results for 
some types of microprocessors have shown an order of magnitude difference in cross 
section for different types of test conditions [Howa 01 ]. 

The SEE test coverage of the test program and the bias conditions of the part during 
irradiation play a major role in single-event upset testing. It is important that the test 
conditions give a worst-case sensitivity compared to the actual application conditions. It 
is also important to test the part at the application frequency. As feature sizes are reduced 
with advanced microcircuit technology, the cells become faster, and transients are more 
likely to be passed as logic signals. A test at lower frequencies may underestimate the 
device output errors. 


4.3.2.4 Single Event Latchup (SEL) testing 

Many circuit variables affect latchup testing, including the bias conditions applied during 
testing. Latchup tests should be made under conditions of maximum power supply 
voltage. Because latchup is a relatively slow process, the diffused charge is extremely 
important during latchup testing. It is important that particles have a sufficient range. 

In most cases a power monitoring and control circuit is used during latchup testing that 
allows power to be shutdown quickly after latchup is detected. If power cycling occurs, 
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care must be taken to account for the “dead time” between shutdown and power up when 
the latchup cross section is evaluated. 

Although latchup usually produces large increases in power supply current, some circuits 
exhibit very small changes in current (“microlatches’). These microlatches may be caused 
by localized latchup paths, which have relatively high resistance, or by other effects, such 
as snap back [John 96]. 


4.3.2.5 Power MOSFETs SEB/Single Event Gate Rupture (SEGR) 
testing 

The SEB/SEGR testing approach is to identify the threshold voltage Vos(th) for failure 
for a given ion, a fixed V G s and temperature. The selected ion should represent a realistic 
worst case for the environment. Ni or Fe ions at normal angle of incidence provide a 
realistic worst case because there is no increased susceptibility from grazing angle ion 
strikes [Tast 91, Mour 94, Titu 95]. However, it is recommended that these tests be 
performed at a slightly higher LET with Br or Kr ions. 

This approach allows indicating a voltage-operating limit to the designer, but it will not 
allow estimating the failure probability if the designer chooses to operate above 
threshold. To obtain SEE rates for a specified environment and operating conditions, a 
LET cross section curve is needed. In case of SEGR, this approach requires a large 
sample size and still does not provide an adequate basis for calculating the device failure 
rate [Nich 96]. 


4.3.2.6 SET testing of linear analog devices 

One of the characteristics of Single Event Transient (SET) in linear devices is that their 
pulse widths and amplitude are influenced by the device bias conditions. This makes the 
SET characterization very complex. A part has to be tested under a large number of bias 
conditions to get an exhaustive characterization. Another difficulty is that these parts 
have different sensitive regions that could give totally different transient waveforms. This 
makes the SET waveform analysis very difficult. It is important to analyze accurately the 
waveforms because their characteristics will determine the effect of the SET on the 
application. The test set-up may also have an effect on the transients collected [Poiv 02]. 


4.3.2.7 Other radiation sources 

Other alternative radiation sources are sometimes used for Single Event studies: 

- Californium: The fission products from 252 Cf have LET distributed primarily 
in the range of 41-45 MeVcm 2 /mg and a range of about 10 pm. Due to this low 
penetration range 252 Cf could only be used to get a qualitative estimate of SEE 
sensitivity. This test is useful to check the test set-up before accelerator testing 
and is a cheap way to compare SEP sensitivities for part type preselection. 

- Laser: Laser light is also an easy way to create SEEs in devices in the 
laboratory. This technique has been proved to be very useful for SEE 
mechanism studies and part hardening [Buch 96, Poug 00]. It can also be used 
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for part assurance screening to compare the sensitivity of different 
manufacturing lots. But laser light and heavy ion charge deposition processes 
are fundamentally different. So laser testing cannot be used directly to 
characterize the in orbit behavior of a part. Heavy ion test data is always 
necessary to calibrate the laser data on a given part. 


4.3.3 Bulk damage, displacement effect testing 

Displacement damage testing for the space environment is performed using the step stress 
approach. Although a significant amount of transient annealing can occur immediately 
after a short pulse of radiation, this effect is not a factor for space particle fluxes. The 
permanent damage is stable at room temperature, hence no significant annealing occurs 
between irradiation steps. 

It has also been shown that bias has little effect on the permanent displacement damage. 
This allows irradiation to be performed passively [Mars C 99], Therefore displacement 
damage testing consists of simply characterizing the electrical performance of the part, 
exposing to an irradiation source, without bias, to a fixed particle fluence and 
characterizing it after irradiation to determine the parameter degradation. However, for 
photonics devices the degradation may be application dependant. For example, Reed 
showed this application dependence for optocouplers in [Reed 98]. For these devices 
active measurements, that match the application, are recommended. 

The radiation source used is generally a mono-energetic proton beam, and the part is 
irradiated to a fluence greater than the mission DDD or equivalent fluence established 
with the NIEL. It is very important to choose adequately the test energy. For low 
quantities of shielding a low energy (ie 10 MeV) is adequate because it represents best 
the environment. For higher shielding, a higher energy is needed (ie 60 MeV), because 
most of the damage results from protons higher than 10 MeV [Mars C 99], Reed 
recommends testing optocouplers at multiple energies because of the inconsistency 
between experimental determination of damage factors and theoretical calculations with 
NIEL [Reed 02], 

Protons are also heavily ionizing with a larger fraction of the energy loss going into 
ionization, therefore the effects will include both displacement and ionizing dose 
damages. The test total deposited dose needs to be calculated and the results compared to 
a Co-60 TID test to sort out failure mechanisms. 

For solar cells the radiation source is generally a mono-energetic electron (IMeV is a 
standard value) or proton (10 MeV is a standard value) beam, and the part is irradiated to 
a fluence greater than the mission equivalent fluence established with the NIEL or with 
the damage equivalent models. 
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5.0 DEFINE THE SYSTEM/SUBSYSTEM RESPONSE TO THE 
RADIATION ENVIRONMENT- PARTS CATEGORIZATION 


5.1 General 

Considering the individual part radiation sensitivities, the radiation environment and the 
system/subsystem design, an analysis of the system/subsystem response is performed. For 
each radiation sensitive part the Radiation Design Margin (RDM) is defined and then 
each part could be classified as Hardness non critical. Hardness critical or not acceptable. 
For the parts belonging to the two last categories, risk reduction actions are taken. 


5.2 Total ionizing dose 

5.2.1 Define the radiation failure level 

The radiation failure level of each part in each application is defined. This corresponds to 
the maximum parametric and fimctional device characteristics limits so that the 
application/function will operate according to specification over the design lifetime. This 
is a two step process: first the maximum parameter limits are defined via circuit analysis, 
then the part radiation data is used to define the radiation failure level Rf. As, the 
distribution of failure levels follows often a lognormal law. Pease recommends that the 
geometric mean Rmf be used to represent the nominal value of the failure level Rf 
[Peas 94], 

The design radiation analysis is part of the design Worst Case Analysis (WCA) that 
combines the effects of radiation, temperature and parts aging. Circuit WCA is needed on 
each engineering subsystem and science instrument in order to demonstrate that the 
design will work in its environment under the most stressful operating conditions (data 
rates, voltages, switching transients,...). The circuit WCA is usually performed by the 
design engineer. 

Figure 18 shows the degradation of the offset voltage Vio of an operational amplifier 
PM 155 versus total dose. The data has been collected on 8 parts from the same lot and 
the average has been calculated. If we consider the specification limit of 2mV, the failure 
level Rf is about 40 krad. If we consider an acceptable limit for a given design of 4 mV 
(this means that the acceptable Vio for this design will be higher taking into account the 
temperature variation and the part aging), Rf will be about 75 krad for this particular 
application. 
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Figure 1 8: degradation of the offset voltage of a PM] 55 
operational amplifier versus total dose. 


5.2.2 Define the radiation specification/levels 
5.2.2.1 Introduction 

The radiation levels for each sensitive part are defined by the methods described in 
chapter 3. For a given part type, the radiation level is defined as the worst-case radiation 
level. Generally the power budget and weight are critical parameters for a space system. 
Because of the ease of stopping some part of space radiation, all components of a 
spacecraft can be thought of as shielding one another. All mass surrounding a radiation 
sensitive part can be regarded as shielding or protection even though that mass serves 
other primary, usually structural, purposes. Electronic box platforms, box covers and 
circuit boards also provide shielding. A part in the center of a stack of printed circuit 
boards may be exposed to only one tenth of the dose received by the same circuits on the 
uppermost board of a stack. The spacecraft and electronic boxes layout has a fundamental 
importance in the design of a radiation tolerant spacecraft. Therefore, an accurate model 
of the spacecraft and a radiation analysis will allow defining the lowest radiation levels. 


5.2.2.2 Spacecraft materials 

A space vehicle is composed of a large number of small components of widely varying 
materials. Generally it is impractical to consider every material in the dose analysis, and 
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generally we consider an “equivalent thickness” of a representative atomic number like 
Aluminum. 

But if the analysis is performed with a Monte Carlo code, it will be much more accurate 
to consider the real nature of the materials. 


S.2.2.3 Spacecraft structure as a radiation stopper 

To calculate the dose levels at a given point within a given box, all radiation-absorbing 
masses present in the satellite have to be taken into account. These, of course, constitute 
an extremely complex array of masses, but an accurate model will allow one to calculate 
as closely as possible how they contribute to radiation stopping [Holm 93]. The dose 
analysis could be done by a sector analysis or a Monte Carlo simulation as described in 
chapter 3.2.2. Figure 19 shows the results of a Monte Carlo radiation analysis performed 
on different locations within the electronic box of the ST5 spacecraft. These results 
illustrate the significant effect of a location within a spacecraft. If the radiation shielding 
is considered when the spacecraft layout is defined, a significant shielding can be 
provided without any added weight to the most sensitive parts. In the ST5 example, it has 
been decided at the beginning of the project to put the Command and Data Handling 
(C&DH) subsystem in an enclosure at the center of the spacecraft. We can see in Figure 
19 that the dose levels for the different points analyzed in the C&DH subsystem are 
lower than 5 krad. This allows the use of commercial memories in this subsystem. 
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Figure 19-a: ST5, dose levels within the spacecraft. 
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5.2. 2. 4 Add-on shielding 

If built in mass on the spacecraft cannot be arranged so as to protect all sensitive 
components, then-as a last resort-some ‘add-on’ absorber may have to be judiciously 
added. The first aim of add-on shielding is to interpose a few millimeters of any suitable 
material between the device of interest and the external environment. If the array of 
devices to be shielded is small, we can save weight by enclosing the array in a compact 
shield rather than build the same thickness outside the box. This is the idea of local 
shielding: simply to obtain a given dose reduction in a given volume for the minimum 
weight penalty. For instance, a single integrated circuit would be best protected by a blob 
of filled plastic applied directly to the package or by using heavier materials (like Kovar, 
Tantalum,,..). This type of shield is called a spot shield. 

The particle-scattering property of materials has some dependence on the atomic weight. 
This is weak in the case of protons and strong in the case of electrons. Thus the choices 
of atomic weight for an add-on shield in a proton-dominated orbit might differ from that 
for an electron-dominated orbit such as the geostationary case [Mang 96], Heavy 
materials like Tantalum and Kovar have a better shielding efficiency for electron- 
dominated environments. A better shielding efficiency means that the same shielding will 
be provided for less weight of shielding material. Light materials like Aluminum oxide 
(AI2O3) have a better shielding efficiency for proton-dominated environment. However 
the effect of the material is not very significant (less than 10%) in these orbits [Astr 01]. 
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Some “hardened packages” made with layers of heavy and light materials could be a very 
effective way of protecting a sensitive device, especially in the case of electron 
dominated orbits. But, a spot shield of about 1 g/cm 2 on a standard package will have a 
similar effect [Astr 01]. 


5.2.3 Parts categorization 

Once the radiation specification levels and part failure levels are determined for each part 
type, the categorization criteria are applied to determine the suitability of the part. The 
categorization criterion is based on the Radiation Design Margin (RDM) defined as the 
part failure level Rf divided by the radiation level Rl. The uncertainties in the 
environment, part tolerance and shielding analysis are considered in the design margin. 
The US Space Working Group (SPWG) has developed two formalisms for 
categorization: the Design Margin Breakpoint (DMBP) and the Part Categorization 
Criterion (PCC) [Peas 94]. The DMBP is a qualitative approach recommended for 
systems with moderate requirements according to the MIL-HDBK 814 guideline 
document for ionizing dose and neutron hardness assurance. The application of the 
DMBP method for categorization is shown in Table 5. 


Table 5: Application of the DMBP method for categorization [Peas 94], 


RDM 

Categorization 

< 1-2 

Unacceptable 

1-2<RDM<10-100 

Hardness Critical 

RDM> 10-100 

Hardness non critical 


If a part is found to be unacceptable, the alternatives are: 

expertise and radiation analysis: perform a more accurate analysis of the 
received radiation levels to determine if the expected dose levels are actually 
lower. Test the part in the application conditions, or at low dose rate (CMOS 
device) in order to increase the part radiation failure level. 

Redesign the system either to change the part failure level (design hardening) or 
to change the dose level (change the spacecraft layout, spot shielding). 

Substitute a harder part. 

Acceptable parts may or may not require hardness assurance. The dividing line between 
whether or not hardness assurance techniques are required is usually set at an RDM of 
10-100 [Peas 94]. Parts that are categorized as hardness non-critical could be used with 
no further evaluation. For those devices which are hardness critical, the most used 
hardness assurance testing is the flight lot sample radiation testing. 

The PCC method is a more quantitative approach to part categorization. In this method a 
statistical approach is used based on an average and standard deviation of the sample 
characterization data [Peas 94]. PCC is defined as: 

PCC=exp(KjLs) for log normal distribution law 
or 

PCC= 1+Ktls/R 1 for a normal distribution law 

where 

s = standard deviation of the radiation test data 
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Ktl - one sided tolerance factor based on sample size n, confidence level C and 
probability of survival Ps. 

To apply the PCC approach to categorization, one may first define a probability of 
survival and a confidence level for the system or subsystem considered, then, a Ps and C 
could be established for each part. The values for K TL are given in the MIL HDBK-814. 
Figure 20 shows the values of the one sided tolerance factor in function of the test sample 
size for some values of Ps for a 90% confidence level. 

We can see in the figure that K T l increases very quickly for sample sizes lower than 10, 
smaller values of n will give high values of PCC. The application of the PCC method for 
categorization is shown in Table 6. 


Table 6: Application of the DMBP method for categorization [Pease 941, 


RDM 

e — . t Z. _ LAI 

Categorization 

< 1-2 

Unacceptable 

1-2<RDM<PCC 

Hardness Critical 

RDM>PCC ~ 

Hardness non critical 


Figure 21 shows the degradation versus dose of the bias current lb of a PM 155 
operational amplifier. 22 samples from three different manufacturing lots have been used. 
The average and the one sided tolerance limit have been calculated based on log normal 
law, Ps=99 and C=90%. For these values of Ps and C, K T l is equal to three. 
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Figure 21 : Degradation versus dose of the bias current of a PM155 operational amplifier. 

If the maximum current is 0.4 mA, the failure level, based on the average, Rmf is equal to 
about 66 krad. If the radiation margin is equal to 1, 50% of the parts will fail this 
criterion. This risk is generally unacceptable. If the dose level is 33 krad, the RDM is 
equal to 2, and is close to PCC. Therefore, the risk of failure will only be 1% with a 
confidence level of 90%. 


5.3 Displacement Damage 

The approach for displacement damage analysis is similar to TID. The test data and the 
design WCA allow the definition of the failure level Rf. Then, the failure level is 
compared to the DDD or the mission equivalent fluence to define the Radiation Design 
Margin. Generally the design margins requirements for DDD and TID are the same. 

Devices sensitive to Displacement Damage are also sensitive to TID. For proton 
dominated space environments, DDD proton testing can deliver sufficient TID to 
estimate both the DDD and TID induced degradation. Otherwise, the effects of TID and 
DDD need to be combined for the design WCA. Reed proposes such an approach to 
estimate the CTR degradation for a specific mission DDD and TID [Reed 01]. The 
process is shown in Figure 22. 
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5.4 Single Event Effects 
5.4.1 General 

For SEE analysis, the SEE data is compared first to the radiation environment and then a 
Single Event Effect Criticality Analysis (SEECA) is performed. Different approaches to 
SEE analysis depend on the possibility of calculating a SEE rate. 


5.4.2 Error rate Prediction 

When SEE error rate predictions are technically possible (case of Single Event Upset, 
Single Event Latch-up, Single Event Transients, for example), an error rate is calculated 
based on test data and the SEE radiation environment. Table 7 shows an example of 
analysis requirements depending on the part SEE sensitivity. Heavy ion and proton 
induced SEE rates will be calculated under quiet and under solar event conditions. 


Table 7: Example of SEE analysis requirement. 


SEE LET threshold 

Requirement 

> 100 MeVcm7mg 

SEE risk negligible, no further analysis needed 

15 MeVcm7mg<LETth<100 MeVcm7mg 

SEE risk low, heavy ion induced SEE rates to 
be analyzed 

LETth < 15 MeVcm7mg 

SEE risk high, heavy ion and proton induced 
SEE rates to be analyzed 


Calculation of heavy ion SEE rates involves three different quantities: 

- The cross section curve of the device determined experimentally 
The heavy ion LET spectra and proton energy spectra 

- The critical charge, sensitive area and sensitive volume associated with the SEE 
of interest. 
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The sensitive geometry and critical charge are the most difficult parameters to determine. 
Charge tunneling, which extends the collection depth below the depletion region, cannot 
be determined directly and involves an assumption about device geometry. Charge 
collection assumptions are more straightforward for epitaxial processes, where it is 
usually reasonable to assume that the charge collection depth is limited by the epitaxial 
layer thickness [John 96]. 

CREME96 is the standard tool to calculate the SEE rates with the help of HUP and PUP 
routines for heavy ion induced SEE and proton induced SEE respectively. The HUP 
routine uses the standard Integral Rectangular Parallelepiped (IRPP) method to calculate 
the Single Event Effect rate [Pick 96]. Either the test data or a Weibull fit of the test data 
could be used. The proton induced prediction method is a direct convolution of the proton 
energy spectrum with the upset cross section versus energy curve. Either the two 
parameter Bendel model or a Weibull fit (if there are sufficient data points) could be used 
to define the proton test data. 

Some optoelectronics devices (photodetectors, fast optocouplers) are also sensitive to 
proton induced direct ionization. Single Event rate prediction methodologies have been 
proposed [Reed 01, Mars P 02]. They generally use the standard tools available in 
CREME96. These techniques are still under validation. 


5.4.3 Criticality analysis 
5.4.3.1 Introduction 

SEE requirements depend on the functions the devices perform. Many SEEs are different 
for different device types. For example, memories will exhibit different conditions than 
linear devices. In addition, SEEs may present functional impacts by propagating through 
the design and impacting other areas. These two conditions make each single event 
problem different in terms of failure mode and effect. SEE analysis is most effectively 
supported by viewing a design or system from the perspective of the function(s) 
performed. 

The objective of a conventional functional analysis is to define a comprehensive set of 
baseline functions and functional performance requirements which must be met in order 
to accomplish the overall mission objectives. This is achieved by the breakdown of top- 
level requirements into successively lower level performance requirements, in a 
methodical and traceable manner. Functional analysis applied at lower levels involves the 
breakdown of requirements and functions at the subsystem, card, circuit, and device 
levels. Top-level functional analysis is useful in requirements generation, such as for SEE 
tolerance. Lower level functional analysis is useful in SEE impact assessment, or failure 
modes and effects analysis. 

One objective of viewing a design or system in terms of function is to determine the 
criticality of the function(s) performed on an operational level. Many SEEs present a 
functional impact, but do not cause permanent damage to the device. Depending on the 
criticality of a function, these non-destructive conditions may or may not be acceptable in 
a design. In assessing criticality, we determine the impact of an SEE in a device on the 
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functions it performs. Device hardness requirements are not considered here, since SEEs 
may be mitigated through many routes. What is of interest is the operational impact of a 
specific device SEE propagating through the design or system. 

Functions may be categorized into “criticality classes” or categories of differing severity 
of SEE occurrence. Many times, most or all of the functions performed by a design or 
system are considered critical to a mission. The operational impact of SEEs in critical 
functions may be unacceptable. For these designs, usually either no single event effects, 
or a very small probability of SEE occurrences, are permitted. When considering a 
subsystem, some components may not be SEE-critical, while data storage memories may 
tolerate SEEs if utilizing error correction schemes. Both of these functions are located in 
the Data System. 

In general, one might consider three criticality groups for Single Event Upset: error- 
functional, error-vulnerable, and error-critical. Functions in the error-functional groups 
may be unaffected by SEUs, whether this immunity is due to an implemented error- 
correction scheme or redundancy, and a large probability of SEU at the device level may 
be acceptable. Functions in the error-vulnerable group might be those for which the risk 
of a low probability is acceptable. Functions in the error-critical group are functions 
where SEU is unacceptable. Figure 23 shows the decision tree for criticality analysis. 

This functional criticality concept applies directly at the device level. One may specify 
the criticality of a device function and determine whether current device tolerance needs 
and mitigation schemes are adequate to protect the system from impacts. Functional 
criticality is also a direct lead into SEE requirements generation on any level, including 
spacecraft, system, and subsystem. 

Once the criticality of functions is determined, requirements for design, including 
hardware and software may be directly obtained. The more critical a SEE is to 
operational performance, the stricter the SEE requirement should be. Figure 24 shows the 
SEE requirement generation flow. 
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Figure 23: Decision tree for criticality analysis. 


5.4.3.2 SEU propagation [LaBe 96] 

A SEU that appears at a device output propagates to its associated circuitry and the 
analysis of the impact of this upset at subsystem, system and spacecraft level should be 
performed. For example, a SEU that occurs in an Analog to Digital converter can cause a 
single incorrect data sample to be gathered. This “invalid” data sample may provide an 
incorrect data point such as a star location or a misleading telemetry value. 

The concept of propagated SEUs is straightforward to the typical electrical engineer. It is 
similar to what one might perform in a standard circuit simulation, that is, how a signal 
pulse, transient, or state will affect a circuit’s performance instantly or in future clock 
cycles. SEU propagation analysis is also similar to Failure Mechanism Analysis 
(FMEA). In both instances, the end goal is to determine the end effects that an error or 
failure has on performance of a device, circuit, or system. 

The first step is to determine where and what type of SEU may occur. How a device is 
being utilized in its specific application may affect its SEU performance as well. 
Parameters such as access rates, operational modes, clock frequency, power supply 
voltage, etc., have definitive impacts not only on the occurrence, but also on the 
observed effect of an SEU. For example, on an LM139 voltage comparator, most of the 
transients have a large amplitude when the differential input voltage is low. 
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Now that we have determined the sensitive devices and operational effects on observed 
SEUs, the determination of what apparent effect the SEU has on device performance 

must be explored. Several outcomes may appear. These include, but are far from limited 
to: 

improper device operation 

- incorrect device output 

- errors in memory structures to be accessed externally 

- noise spikes on transmission lines 

- device mode change such as going from an active to standby mode, functional 
interrupt 

- incorrect device timing 



Circuit level analysis follows the same steps but with the key now being the circuit 
operation and performance. As with device level analysis, once we know which devices 
have SEUs and what those SEUs may look like, we then look at the operational 
parameters and their impacts on SEU performance. For example, we know that a bit flip 
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may occur in a SRAM, but the circuit level effects are dependent on the way the SRAM 
is being used for in this application. Sample propagated effects might include: 

- an SEU in a SRAM being used for data storage: a bad data point. 

- an SEU in a SRAM holding software program instructions: improper operation or 
flow. 

Once the operational analysis is performed, the engineer is again able to perform a circuit 
simulation using digital or analog tools. The output of this analysis is a list of the 
potential SEUs in a circuit and their effects on circuit operation. We may view this as a 
“black box” wherein the internal circuitry doesn’t matter, but what is observed by the 
outside world (subsystem, system) is noted. 

We may treat subsystem, system, and spacecraft levels of analysis in a similar manner. 
Once the circuit level analysis is complete, we begin the subsystem level analysis. In 
essence, we may treat the subsystem exactly like the circuit level, but look for 
performance aspects of the SEU-induced anomaly. The system level takes this one step 
further. The spacecraft level of analysis then would take the output of the system level 
analysis and determine, in this case, whether the incorrect command would affect the 
overall spacecraft operation. For example, we might observe incorrect instrument data 
being gathered or a system safing occurence. 

An example of this type of analysis is given in [LaBe 96]. 


5.4.3.3 Definition of SEE requirements [Mars P 96] 

5.4.3. 3.1 System level requirements: 

The system level requirements should be expressed in view of all possible ways in which 
Single Event Effects could compromise mission performances. The two main categories 
are system availability and information quality. 

- System availability: System availability requirements address extreme events 
leading to possible loss of mission as well as less severe events which might 
require ground station or possibly autonomous reset with a brief disruption in 
system performance. Typically, availability requirements for Single Event Effects 
have been expressed in general terms along the lines of “no single event effect 
(e.g., latch-up or any other potentially catastrophic SEE related failure mode) 
shall be allowed to result in the loss of the mission.” Additional availability 
requirements can be specified in terms of the severity of disruption, the acceptable 
frequency of disruption, or the maximum duration of disruption, or some 
combination of the three. In addition to SEE induced hard failures, soft errors may 
occur which disrupt system performances but allow complete system recovery. 
For example, it might be required that the normal mission operations not be 
disrupted by any single event effect with an outage requiring ground station 
intervention more than once per year, and the occurrences of autonomously reset 
disruptions cannot happen more than once daily with the system recovery 
required to result in an overall system availability of 0.9993 (corresponding to 
system unavailable for 1 minute per day on average). SEE requirements might 
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also reflect the compromise between mission objectives and cost constraints by 
allowing for less stringent performance under extreme circumstances. For 
example, if the mission science objectives of a LEO platform do not require 
highest availability levels while in the South Atlantic Anomaly (SAA), then the 
SEE/SEU requirements might be relaxed in that region with substantial cost 
savings. Similarly, if more frequent disruptions of operations could be tolerated 
for short duration over the course of a multi-year mission, then the requirements 
could be relaxed for anticipated solar flare related particle bombardment, which 
might be several orders of magnitude more harsh than daily peak particle fluxes 
under normal conditions. 

- Information integrity: As a separate requirement from system or subsystem 
availability, the mission might consider the payload functional requirements in 
term of information integrity. In many cases, soft errors can occur in a relatively 
benign manner which affect data without altering the system functions. For 
example, a soft error in a sensor A/D converter or in a data path might result in a 
glitch in an image. Such errors do not interrupt the flow of information, but rather 
degrade its quality. These less severe types of single event errors lend themselves 
to Error Detection and Correction (ED AC) techniques [LaBe 96]. The 
implementation of EDAC and the type of approach selected should be based on 
the following: the environment, the hardware, and the requirements for data 
integrity. The establishment of reasonable requirements at the mission planning 
stage should lead to acceptable, but not necessarily error free, performance within 
constraints of cost and design complexity. The form of the data integrity 
requirement for the payload will likely reflect the type of information being 
collected and how it is handled between collection and downlink. As an example, 
a charged coupled device (CCD) for earth imaging might be the source of a data 
stream which flows from a camera through a data bus to a solid state recorder and 
then to a downlink. In such a case the top level requirement might be, for 
example, no more than 3 bad pixels per frame of imagery. Another form of a top 
level requirement in this example might be a bit error rate (BER) requirement. 
The establishment of such top level requirements provide the basis for subsequent 
SEE criticality subsystems assignments as the error budget is allocated to the 
various potential sources (e.g., proton events in the CCD pixels, SEU in camera 
ADC, bits errors in the data bus, soft errors in the solid state recorder). Examples 
detailing this process are given in [Mars P 96], Just as with the availability 
requirements already discussed, the top-level data integrity requirements could be 
tailored to the mission needs in terms of different performance levels for different 
aspects of the environment (e.g., SAA and solar event). Whenever the most 
demanding performance requirements can be separated from the most severe 
environmental conditions, mission complexity and cost can be reduced, and it is 
the proper expression of the top-level system requirements which allows this. 


5.4.3. 3.2 Criticality assignments 

As a part of mission planning, functional requirement definitions for each primary 
function are established, and this may occur without consideration of radiation effects. As 
part of the single event effects assessment, these same functions must be ranked 
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according to the degree of severity their temporary disruption or permanent loss would 
impose as described in Figure 23. 

Functions can be broadly sorted into payload versus bus groupings. Bus functions would 
typically include Telemetry and Control, Power and Power Distribution, Data Bus and 
Mass Memory Storage, and Downlinks, whereas payload functions would tend to be 
more mission specific and include things such as UWVisible imaging, Infrared imaging, 
Environment monitors. Obviously, all are important functions, but some (especially those 
associated with the bus) are clearly mission critical. Even though Telemetry and Control 
or other essential functions are always protected against any single point of failure by 
dual redundant architectures, it is usually assumed that loss of a redundant portion of a 
critical subsystem should not be allowed to occur due to an SEE. Thus all subsystems 
supporting mission critical functions would typically be designed assuming error-critical 
levels. 

Other functions, for example a secondary experiment payload to evaluate a new 
technology, might be considered of less importance, and the only mission imposed 
requirement might be that a failure within the experiment, SEE induced or otherwise, 
must not affect the host. Even so, the experiment designers would likely have 
considerable investments in the experiment and would consequently impose their own 
higher level criticality to assure the success of the experiment. 

In between these two extremes we have the error-vulnerable category in which a certain 
number of errors could be tolerated or mitigated with acceptable performance. Many 
satellite functions are inherently error-critical, but wherever error-critical ratings can be 
avoided, they should be. The error-vulnerable category allows considerable flexibility in 
providing acceptable performance with reliance on less expensive parts and less complex 
systems. 


5.4.3.3 .3 Allocation of SEE requirements to subsystems 

As the mission development progresses from planning to satellite conceptual design, the 
satellite functions are divided across various hardware subsystems, each of which will 
have to perform within certain measures to meet system top level functional 
requirements. Along with the division of satellite functions across these subsystems, the 
preliminary design phase will also include a set of derived SEE requirements which will 
flow out of the top level SEE requirements. 

As with the case of top level requirements, the subsystem derived requirements should be 
expressed in terms of availability and, where appropriate, information integrity. It is the 
role of the team comprised of the radiation environment and effect specialists, the 
subsystem lead engineers, and the system engineers to establish the subsystem level 
derived requirements based on the subsystem function. The budgeting of availability and 
information integrity requirements may occur across multiple subsystems where those 
subsystems are functionally related. In no case should the availability or performance of 
the subsystem (or collection of functional related subsystems) be designed with SEE 
vulnerability in excess of that allowed based on the functional criticality. 
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However, the transmission of CCD imagery, which might be a primary mission objective, 
would not necessarily be deemed error-critical, and the cost associated with guaranteeing 
uninterrupted, error-free data might be prohibitive. In this case, availability and 
information integrity allowances could be applied to the function of CCD image 
collection and transmission in the top-level requirements. It is then the task of the 
engineering team to allocate this error allowance between the CCD camera, data bus, and 
solid state recorder subsystems. This is typically done along with functional requirements 
definition in the preliminary design phase, and it necessarily relies on past experience and 
educated guesswork with anticipation of the trades associated with the difficulty of 
hardening against or tolerating SEE in one subsystem versus another. 

In this manner, functional requirements from the top level and associated SEE criticality 
levels for those functions are translated into SEE requirements at the system and 
subsystem hardware levels. This allocation of error allowances necessarily must occur 
early in the preliminary design, but it may be a dynamic process which continues into the 
detailed design and through test and evaluation phases. With system cost and complexity 
always guiding the trades, the reallocation of SEE error allowances may be required due 
to a number of factors, such as the availability (or cost) of SEE hardened parts or test 
results on candidate components indicating different sensitivities in ground radiation tests 
than anticipated based on initial information. 


5.4.3. 3. 4 Detailed subsystem SEE design and analysis 

At this point we have established functional SEE requirements with assigned criticality 
levels, which in turn have been applied to error allocation budgets at the hardware 
subsystem level. It is now the task of the subsystem engineering team to allocate their 
error budgets among the various segments of the subsystem in a manner that minimizes 
the system cost and complexity. 

The SEECA approach would now be applied to the subsystem level with the possible 
failure modes gauged according to what the effect might be and whether or not it reaches 
the boundary of the subsystem to impact the allocated error budget. In this sense, the use 
of SEU soft parts might be allowed even within a subsystem designated error-critical, 
provided error mitigation techniques within the subsystem prevented the errors from 
reaching the subsystem boundaries. Through this process, the error budget is managed 
through the completion of detailed design, and with control of cost and complexity as the 
driving forces. 


5.4.3.4 Destructive events 

Destructive SEE conditions (Single Event Latch-up, Single Event Gate Rupture, Single 
Event Burnout) may or may not be recoverable depending on the individual device’s 
response. Hardening from the system level is difficult at best, and in most cases not 
particularly effective. Generally, parts with a non-negligible destructive SEE rate should 
not be used. On a case-by-case basis use of these parts with adequate circumvention 
methods could be authorized. Examples of mitigation methods are given in [LaBe 96]. 
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5.4.3.5 Non destructive events 

Once the acceptable event rates are defined, they are compared to the device event rates. 
Generally a Radiation Design Margin of at least 2 is required. If a part is found to be 
unacceptable, the alternatives are to redesign the system (to increase the acceptable error 
rate) or substitute a harder part. As mentioned before, another alternative could also be 
the reallocation of the acceptable error rates. Examples of SEE mitigation methods are 
presented in [LaBe 96-2]. 


5.4.4 Particular case: Error rate prediction not possible 

For Single Event Burnout (SEB) and Single Event Gate Rupture (SEGR) of power 
MOSFETs, error rate prediction techniques are not mature. Hardness assurance is then 
based on derating of maximum operating values [Nich 96]. The values of the derating are 
obtained by characterization. In the past, it has been common practice to consider that up 
to 200V devices, a 50% derating of maximum operating values would not lead to any 
SEB sensitivity. This is no longer true on some new technologies. A test is recommended 
on any new device to define the acceptable derating. 


6.0 MANAGEMENT OF HARDNESS ASSURANCE 
6.1 Introduction 

Figure 25 shows the different groups who interact in order to form a spacecraft design 
team. It shows that a large number of people, factors, and considerations go into a system 
design. Conflicts between the requirements for different environments are resolved 
through trade-off in design studies. The arrangements for resolving conflicts and getting 
the work done are contained in a series of project documents. This system of 
requirements and reviews forces the hardware designers and builders to implement the 
design features required to meet success criteria. 

There are many ways of managing the process of hardness assurance described in the 
previous chapters. The options are a centralized radiation effects management or a 
devolved management, in which subsystem engineers are responsible for all 
environmental constraints. The latter option is generally used for space systems. 
Requirements are reflected through a Radiation Environment specification and a 
Radiation Hardness specification, which define the external environment, the techniques 
to be used and the radiation design margin required. At NASA-GSFC a lead radiation 
engineer is assigned to each space flight project. The RHA engineering process is viewed 
in a manner similar to that used by a mechanical or a thermal engineer who is assigned 
for the life of a project. With a single point of contact for all project radiation issues 
(environment, device selection, testing) each program has a radiation effects expert 
responsible for ensuring performance in the radiation environment. By participating early 
in flight programs, the radiation effects engineer may contribute to cost reduction 
strategies. 
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6.2 Radiation specifications 
6.2.1 Introduction 

The two primary documents related to radiation effects analysis are the radiation 
environment specification and the Radiation hardness specification. These two 
documents could be merged into a single document. The parts top-level requirements are 
also reflected on the Parts Control Plan document. 


6.2.2 Radiation Environment specification 

The radiation environment specification for the mission should include: 

a) The unshielded mission-average proton and electron energy spectra from trapped 
radiation. 

b) The unshielded fluence spectrum of solar protons for the complete mission. 
Appropriate geomagnetic shielding shall be applied. 

c) The unshielded worst-case instantaneous energy spectra of trapped electrons, trapped 
protons and solar energetic protons (geomagnetically shielded) for the mission, for 
internal charging and sensor interference analysis. 

d) The mission-average and peak trapped proton spectra for nominal shielding. 

e) The GCR ion LET spectrum for the appropriate solar cycle phase. A LET spectrum 
for the peak, worst day and worst week solar particle event. The LET spectrum shall 
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include contributions from all ions from Z=1 to Z=92. Appropriate geomagnetic 
shielding shall be applied. Appropriate material shielding shall be applied. 

f) A mission dose versus shielding depth curve or table for dose at the center of a solid 
Aluminum sphere, including contributions from trapped electrons and protons, solar 
energetic protons and electron-induced bremsstrahlung. 

g) The damage-equivalent fluences of 1 MeV electrons and 10 MeV protons for solar 
cell damage estimates. 

h) NIEL 10 MeV equivalent fluences for CCD, optoelectronic and optical components 
as a function of spherical shielding depth. 


6.2.3 Radiation Hardness assurance specification 

A Hardness Assurance specification for the mission should include at minimum: 

a) the mission top level requirements. 

b) the required Radiation Design Margins. 

c) the test requirements. 


6.3 Radiations reviews 

The two main reviews of a project are the Preliminary Design Review (PDR) and the 
Critical Design Review (CDR). Radiation problems are covered in these reviews. In the 
reviews the following topics as appropriate should be covered: 

- At PDR: 

• The proposed mechanical layout to achieve maximum inherent shielding, 
trade-off with thermal control, cabling, fabrication and test efficiencies. 

• The electronic design approach, including circuit design rules, electronic 
parts sensitivity and test requirements, and parts selection parameters. 

• The preliminary shielding analysis. 

- At CDR 

• The results of radiation tests. 

• The materials and special parts sensitivity, including special 
application/screening. 

• The radiation problems previously identified. 

• The circuit design analysis results. 

• The final shielding analysis. 

• The expected radiation design margins. 

Other reviews could be organized to solve specific problems. The purpose of a review is 
to get the experts from different disciplines together so they can help the system 
designers to make the proper decisions. 

One of the main problems in space programs is that sometimes the radiation 
characterization results arrive after the CDR. This could have a significant impact on the 
project cost and schedule, when the results lead to design modifications after the CDR. 
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6.4 Waivers 

Waivers trade risk against project resources or modify requirements for a specific 
situation. In a situation where the solutions to a problem are being developed, waivers are 
used to track all those subsystems affected by the requirement. When requirements are 
not met, waivers are required, in particular when the RDM is not met [Holm 93]. For 
example, a radiation test that might arrive late in the program development and show a 
SET sensitivity that will be a concern for a particular application. The risk is evaluated 
and, rather than undertaking a costly retrofit, the subsystem manufacturer may issue a 
waiver that documents the problem and asks the project to relax the functional 
requirement of this subsystem. The project will evaluate the risk and make a decision to 
accept or reject this waiver request. 


7.0 EMERGING RADIATION HARDNESS ASSURANCE ISSUES 

During the last ten years, we have seen the emergence of commercial off-the-shelf 
(COTS) parts and emerging new technologies in space programs. The first COTS parts 
to fly in space, were memories for use in Solid State Recorders (SSR). Today, the use of 
COTS is common practice. Radiation Hardness methodologies have been adapted with 

the usage of COTS [LaBe 98], Most of the significant points have been addressed in this 
course. 


The main concern with COTS is the variability and the unpredictability of the radiation 
response due to the limited control and frequent processing changes. For COTS it is 
always necessary to test the flight lot. This is a significant programmatic constraint 
because the radiation results may be only available in the last phases of the project 
development, and the impact of bad radiation results may be significant. If there is often 
a way to deal with bad TID results via spot shielding, it is not the same for SEE effects 
Therefore it is important that the design engineers know at the beginning of the program 
all of the potential radiation hazards in order to implement tolerant designs. Another way 
to deal with this problem is to make single buys for Engineering Models (EM) and flight 
models (FM) and test different possible candidates early in the program. This approach if 
used systematically, may be costly. Again, a good knowledge of the possible radiation 
hazards and the possible impacts on the subsystems will help to make the good decisions. 

Another issue with emerging technologies is their increased complexity and performance 
This results in new radiation sensitivities [LaBe 98, John 97]. For example, Single Event 
Functional Interrupt (SEFI) is now a common failure mode. First observed on processors, 
now SEFI is observed on Synchronous Dynamic Random Access Memories (SDRAM) 
[Koga 01] and Analog to Digital Converters (ADC). Removal of power supply and 
subsequent re-initialization are required to resume proper operation. The increased clock 
speed and complexity are also major challenges for radiation testing. This makes the tests 
more expensive and longer to perform. Sometimes, it is very difficult to test the full 
performance of a part. For example, to test the full accuracy of a 16 bits ADC, a 
measurement accuracy of tens of micro volts is necessary. This accuracy is very difficult 
to achieve in the noisy environment of a heavy ion accelerator. In the future, design 
engineers will have to be more involved in the radiation tests to solve these problems. 
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The new packaging technologies are also an important issue. First, the high number of 
input and outputs is another test complexity. Second, some package technologies are 
problematic for SEE testing. For example, most of modem DRAMs have a 150 pm thick 
lead frame that covers the whole die area [Koga 00]. Another example is the PENTIUM 
III processor where the sensitive region on the part is only accessible through the 
backside of the die because of the die mounting technology. The die has a thickness of 
900 pm [Howa 01]. The heavy ion accelerators currently used for SEE testing provide 
ions with a penetration range in the order of tens of pm. This is not sufficient for some 
devices and there is a need for higher energy beams with longer penetration ranges [Poiv 
01 ]. 


8.0 CONCLUSION 

The two main activities of a radiation hardness assurance program are the definition of 
the radiation environment at the part level and the definition of the part failure level. As 
more and more TID sensitive parts are used, a top-level requirement is usually not 
sufficient except for programs with low TID requirements. An accurate spacecraft 
modeling and a 3-D sectoring/ray trace or Monte Carlo radiation analysis allows a 
significant reduction of the TID requirement. Another advantage of having a spacecraft 
model is the ability to analyze the effectiveness of mitigation techniques, e.g., moving 
boxes to locations that offer more protection or adding spot shielding to parts. 

The radiation characterization is the first step of the definition of the part failure level. 
Then, the part radiation sensitivity is compared to the part uses in the different 
applications and the impact at the circuit level, box level, subsystem level, and system 
level. Design mitigation techniques allow the use of radiation sensitive parts. 

All these activities affect the spacecraft and electronic box layout, the system design, and 
even system operations. The radiation hardness assurance process is no longer confined 
to the part level. Radiation hardness has to be taken into account at all the stages of the 
system development. Taking into account the hardness assurance in the early phases of a 
program development will allow reducing significantly the costs of hardness assurance. 

The reader should also keep in mind that there are a lot of uncertainties in this process: in 
the environment definition, in the simulation of this environment at ground level, and in 
the part characterization [Stas 91]. All these uncertainties are put in the radiation design 
margin. To quote Andrew Holmes Siedle and Len Adams [Holm 93], “The recipe for 
restful nights is an RDM value well above 2.” 
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